REMARKS 



Claims 4, 8, 9, 18, 19 and 22 have been canceled. Claims 1, 20, and 21 have been 
amended to clarify the subject matter regarded as the invention. Claims 1-3, 5-7, 9-17, and 20- 
21 are pending. 

The Examiner has rejected claims 1-3, 5-7, 9-17, and 20-21 under 35 USC 103(a) as 
being unpatentable over Gupta in view of Stellenberg. 

The rejection is respectfully traversed. With respect to claims 1, 20, and 21, each has 
been amended to recite concluding "based at least in part on a determination that the pattern 
matching data matches the pattern that a network traffic with which the pattern matching data is 
associated is associated with an application protocol with which the pattern is associated." 
Gupta teaches comparing network traffic to an attack signature to determine whether the traffic is 
associated with a corresponding attack. Paragraph [0084]. The protocol must already be known 
and/or determined by other means before such analysis can be performed. Stellenberg likewise 
describes comparing network traffic to patterns associated with attacks. Col. 4, lines 7-35; col. 
19, lines 20-47. Stellenberg teaches use of a "class identifier function 120" to determine an 
application protocol with which traffic is associated. Col. 17, line 63 - col. 18, line 57. The 
class identifier function is described as analyzing "the header of each packet," "the nature of the 
sequence of packets within the passing stream," and examining the stream itself in ways not 
specified to determine the application protocol. Col. 17, line 66 - col. 18, line 21 . Using pattern 
matching to determine if network traffic matches and attack signature and determining an 
application protocol based on an analysis of packet headers, the "nature" of a sequence of 
packets, and unspecified analysis of a packet "stream" are not the same as concluding "based at 
least in part on a determination that the pattern matching data matches the pattern that a network 
traffic with which the pattern matching data is associated is associated with an application 
protocol with which the pattern is associated," as recited in claims 1, 20, and 21. As such, claims 
1, 20, and 21 are believed to be allowable. 

Claims 2, 3, 5-7, and 10-17 depend from claim 1 and are believed to be allowable for the 
same reasons described above. 
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The foregoing amendments are not to be taken as an admission of unpatentability of any 
of the claims prior to the amendments. 

Reconsideration of the application and allowance of all claims are respectfully requested 
based on the preceding remarks. If at any time the Examiner believes that an interview would be 
helpful, please contact the undersigned. 



Respectfully submitted, 





William J. James 
Registration No. 40,661 



V 408-973-2592 
F 408-973-2595 



VAN PELT, YI & JAMES LLP 
10050 N. Foothill Blvd., Suite 200 
Cupertino, CA 95014 
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